[Snort-users] Are there known bugs in the odbc output plugin WRT FreeTDS and unixODBC? (more debug info)

McCash, John John.McCash at ...10979...
Thu Apr 29 07:29:17 EDT 2004

Well, I've got another update, but I'm seriously finding moss on both sides of the trees now...

I tried configuring freeTDS to use different versions of the TDS protocol. No difference with 7.0, but when I tried 4.2, it got past the point where it was breaking. But then it ran smack into some other issue. Now I get the following snort error on startup (using any TDS protocol version):

Apr 29 09:11:18 aopsecurityserver snort: FATAL ERROR: database: The underlying database has not been initialized correctly.  This
        version of Snort requires version 106 of the DB schema.  Your DB           doesn't appear to have any records in the 'schema
' table.           Please re-run the appropriate DB creation script (e.g. create_mysql,           create_postgresql, create_oracle,
create_mssql) located in the           contrib\ directory.            See the database documentation for cursory details (doc/README
.database).           and the URL to the most recent database plugin documentation.
Apr 29 09:11:18 aopsecurityserver kernel: device eth0 left promiscuous mode

Mind you, the database is, in fact, correctly configured, as I can tell from the Windows side. However when I try to run 'SELECT vseq from schema' in isql, I get the following error:

SQL> select vseq from schema
[][unixODBC][FreeTDS][SQL Server]Statement(s) could not be prepared.
[][unixODBC][FreeTDS][SQL Server]Incorrect syntax near the keyword 'schema'.
[ISQL]ERROR: Could not SQLExecute

But if I do 'SELECT vseq from "schema"', it works fine... But only under TDS versions 7.0 or 8.0... Under 4.2, I get:

SQL> select vseq from "schema"
[37000][unixODBC][FreeTDS][SQL Server]Line 1: Incorrect syntax near 'schema'.
[ISQL]ERROR: Could not SQLExecute

Does anybody know if this is relevant to the problem?

This message is for the designated recipient only and may
contain privileged, proprietary, or otherwise private information.  
If you have received it in error, please notify the sender
immediately and delete the original.  Any unauthorized use of
this email is prohibited.

More information about the Snort-users mailing list